How do I hide the Nginx version number?
Add server_tokens off; to nginx.conf. This removes the version number from the Server response header and error pages, making it harder for attackers to identify known vulnerabilities in your specific Nginx version.
Verify This Answer
Cross-check this information using these trusted sources:
More FAQs in Nginx Security Hardening Protecting Your Node.js App from Attacks
X-Frame-Options (SAMEORIGIN, prevents clickjacking), X-Content-Type-Options (nosniff, prevents MIME sniffing), X-XSS-Protection, Referrer-Policy, Content-Security-Policy (restricts resource loading), and Strict-Transport-Security (HSTS, forces HTTPS).
Set client_max_body_size to limit payload size, short timeouts (client_body_timeout 10, client_header_timeout 10) to prevent slowloris attacks, rate limiting (limit_req_zone with rate and burst), and connection limits (limit_conn_zone).
Use allow and deny directives in the location block: allow 192.168.1.0/24; deny all; This only allows requests from the specified IP range. For basic auth, use auth_basic and auth_basic_user_file with htpasswd.
Still have questions?
Browse all our FAQs or reach out to our support team